The Agent Skills Directory

[SAFE]: The skill provides documentation and instruction for MotherDuck's REST API. It correctly identifies the administrative endpoints at https://api.motherduck.com and emphasizes secure handling of the MOTHERDUCK_ADMIN_TOKEN as a backend secret.
[EXTERNAL_DOWNLOADS]: References the official MotherDuck OpenAPI specification at https://api.motherduck.com/docs/specs. As this is an official vendor resource from a known service, it is considered safe and does not contribute to verdict escalation.
[CREDENTIALS_UNSAFE]: No hardcoded credentials were found. The skill uses standard placeholders like <admin-token-from-secret-manager> and <session_from_backend>, which are best practice for documentation.
[COMMAND_EXECUTION]: Provides standard curl command templates for API interaction. These commands are static, for educational/documentation purposes, and do not execute untrusted remote content.
[DATA_EXFILTRATION]: No patterns of sensitive data exfiltration were detected. The skill focuses on legitimate administrative tasks (creating users, managing tokens) within the MotherDuck ecosystem.
[INDIRECT_PROMPT_INJECTION]: The skill contains a 'Source Of Truth' section that advises the agent on how to treat external documentation. It does not attempt to override system safety guidelines or exhibit deceptive behaviors.

motherduck-rest-api